Still, researchers say apps not as harmful as many feared.

Security researchers have both good and bad news about the recently reported outbreak of XcodeGhost apps infecting Apple's App Store. The bad: the infection was bigger than previously reported and dates back to April. The good: affected apps are more akin to adware than security-invading malware.

Further Reading

"XCodeGhost seems to be far more widespread than initially assumed," researchers from security firm Appthority wrote in a blog post published Monday. "We were able to identify 476 affected apps for our customers from within our database–which is far more than the initial finding of around 40 apps would suggest."

As the graph at the top of this post shows, the outbreak started in April and has steadily gained momentum over the following five months. It's surprising that such a large number of apps were able to violate Apple's stringent App Store policies for such an extended period of time. Researchers from competing security firm FireEye, meanwhile, reported finding 4,000 iOS apps infected by XcodeGhost. Neither firm identified the apps or say if they focused on Chinese-speaking users as most in the earlier batch did.

On a more positive note, the Appthority researchers found no evidence XcodeGhost-infected apps had the ability to trick users into divulging their credentials for the iCloud or other services. Analyses of infected apps showed they had the following capabilities:

Sends requests to the server (using a fixed timer interval between requests)

The request contains all kinds of device identifiers (like a typical tracking framework)

The response can trigger different actions:

Shows an AppStore item within the app by using a SKStoreProductViewControllerDelegate

Showing a UIAlertView and showing the AppStore view depending on which button was tapped

Open a URL

Sleeping for a given time

The researchers continued:

The framework itself contains no code to display login prompts or alerts of any kind that could be used to phish credentials (the alert has no field for text input). The only way to launch a phishing attack using this framework would be to send the response to open a URL pointing to a malicious website.

Apple has also weighed in with a blog post that said there's no evidence any of the apps have been used maliciously. Based on the Appthority findings and Apple's assessment, it appears the XcodeGhost apps were much tamer than many iOS users feared.